Post-market Services
Regulatory Due Diligence
Assess regulatory, quality, and compliance risks across medical devices, software, and AI-enabled products during investment, acquisition, and partnership activities.
Services
- Regulatory due diligence assessments
- Technical documentation reviews
- MDR and IVDR compliance assessments
- FDA regulatory status reviews
- Quality management system assessments
- Software and AI compliance evaluations
- Regulatory risk identification
- Gap assessments and remediation support
Our Specialty
What Do We Offer?
Regulatory due diligence helps organisations evaluate the compliance status, regulatory risks, and operational maturity of medical devices, software products, and healthcare technologies before investment, acquisition, licensing, or partnership decisions are made.
MedQAIR supports investors, manufacturers, and organisations with structured regulatory due diligence activities across MDR, IVDR, FDA, and related international frameworks. This includes reviewing technical documentation, quality systems, regulatory submissions, software lifecycle processes, cybersecurity considerations, and post-market obligations.
Our approach focuses on identifying practical risks and compliance gaps that may affect product viability, regulatory timelines, market access, or ongoing operational responsibilities. The goal is to provide a clearer understanding of regulatory readiness and potential remediation needs before critical business decisions are finalised.
Regulatory Compliance Reviews
Assessment of compliance status against MDR, IVDR, FDA, and applicable international regulatory frameworks.
Technical Documentation Assessments
Review of technical files, software documentation, clinical evidence, and associated regulatory records.
Regulatory Risk Identification
Assessment of quality management systems, lifecycle processes, and operational compliance structures.
Software & AI Assessments
Evaluation of software lifecycle activities, cybersecurity considerations, AI governance, and related compliance obligations.
UDI and Registration Support
Identification of gaps, unresolved compliance issues, and potential regulatory or operational risks.
Remediation & Follow-Up Support
Support with addressing identified gaps, remediation planning, and alignment activities following due diligence reviews.
Relevant Resources - EU
- MDR 2017/745 (EU Medical Device Regulation)
- IVDR 2017/746 (EU In Vitro Diagnostic Medical Device Regulation)
- AI Act 2024/1689 (EU Artificial Intelligence Act)
- EHDS 2025/327 (European Health Data Space Regulation)
- CRA 2024/2847 (Cyber Resilience Act)
- MDCG 2019-11 – Qualification and Classification of Software
- MDCG 2021-24 – Classification of Medical Device Software under MDR and IVDR
Relevant Resources - US
- FDA Medical Devices
- FDA Product Classification Database
- FDA 510(k) Database
- FDA De Novo Database
- FDA PMA Database
- FDA Digital Health Policy Navigator
- FDA Artificial Intelligence-Enabled Medical Devices
Relevant Resources – Standards & International
- ISO 13485 – Medical Devices Quality Management Systems
- ISO 14971 – Medical Device Risk Management
- IEC 62304 – Medical Device Software Lifecycle Processes
- IEC 81001-5-1 – Health Software Security Activities
- ISO/IEC 42001 – Artificial Intelligence Management Systems
- IMDRF Software as a Medical Device (SaMD) Framework Documents
- Health Canada Software as a Medical Device Guidance
Blog Hub
Latest Insights & Updates
Explore our blog posts on MDR, IVDR, and EU AI Act medical device compliance to stay ahead of regulatory changes.
ISO 27001 Requirements: A Clause-by-Clause Reference
ISO/IEC 27001 has been the reference standard for information security management systems since 2005, and its third edition, ISO/IEC 27001:2022, was published on 25 October 2022 (ISO/IEC 27001:2022 and Amendment 1:2024). The transition from
Registration of Medical Devices in the EU and US
Manufacturers have been able to register in EUDAMED, the European database on medical devices, since December 2020 for the Actor module and since October 2021 for UDI and device data, but only on a voluntary basis. That changed on 28
EUDAMED UDI Registration Checklist for Manufacturers
Using the EUDAMED UDI/Devices module became mandatory on 28 May 2026. This follows the Commission Decision (EU) 2025/2371, which formally declared the first four modules functional. Published in the Official Journal back on 27 November 2025, that decision kicked off
Meet the Team: Eva Kurilova-Sahin
We are pleased to welcome Eva Kurilova-Sahin to the MedQAIR team. Eva brings a background in medicine, clinical science, radiology, and oncology research, together with experience in AI-enabled medical technology. Over the past 10 years, her work has brought her
EU AI Act Requirements for AI-Enabled Medical Devices
The regulatory landscape for medical devices is becoming more complex as artificial intelligence becomes part of diagnosis, monitoring, treatment, and clinical decision support. For manufacturers, understanding the EU AI Act medical devices requirements is now essential alongside the existing Medical
Advancements in AI/ML Standards
Artificial intelligence is evolving faster than the regulatory frameworks around it. But that gap is beginning to close, with a growing body of AI medical device standards now moving towards publication and wider regulatory recognition.
Frequently Asked Questions
Find answers to common questions about our services, compliance processes, and how we can assist your business.
What is regulatory due diligence for medical devices?
Regulatory due diligence is the process of assessing the compliance status, regulatory risks, quality systems, and documentation maturity of medical devices or healthcare technologies before investment, acquisition, licensing, or partnership decisions.
What areas are typically reviewed during regulatory due diligence?
Reviews may include technical documentation, device classification, quality management systems, software lifecycle processes, cybersecurity, clinical evidence, post-market activities, regulatory submissions, and ongoing compliance obligations.
Can MedQAIR support due diligence for software and AI-enabled medical devices?
Why is regulatory due diligence important before acquisitions or investments?
Regulatory gaps or unresolved compliance issues can significantly affect product timelines, market access, operational costs, and long-term business value. Due diligence helps organisations identify potential risks and remediation needs before major decisions are finalised.
Is MedQAIR experienced in international regulatory submissions beyond the EU?
Yes. MedQAIR supports regulatory submissions for the US (FDA), Canada (Health Canada), and other global markets. This includes preparing 510(k), De Novo, PMA, and Canadian licensing documentation, as well as aligning technical files for multi-market compliance.
What are the most common regulatory issues identified during due diligence reviews?
Common findings include incomplete technical documentation, unclear device classification, unresolved nonconformities, inadequate clinical evidence, software lifecycle gaps, cybersecurity deficiencies, missing post-market documentation, and quality management system weaknesses. Identifying these issues early helps organisations understand potential remediation efforts and associated business risks.
How does regulatory due diligence differ from a quality management system audit?
A quality management system audit focuses on compliance with defined quality requirements and procedures. Regulatory due diligence takes a broader view by evaluating technical documentation, regulatory status, market access risks, software compliance, clinical evidence, cybersecurity considerations, and overall regulatory readiness in the context of business decisions.
Why is technical documentation reviewed during due diligence?
Technical documentation provides evidence that a product has been developed, validated, and maintained in accordance with applicable regulatory requirements. Reviewing technical files helps identify documentation gaps, unsupported claims, missing evidence, or compliance risks that could affect market access, product valuation, or future regulatory activities.
Can regulatory due diligence identify AI governance and compliance risks?
Yes. AI-enabled products may be assessed for issues relating to governance structures, data management practices, software lifecycle controls, transparency requirements, cybersecurity considerations, and compliance with applicable AI-related regulations and standards. Early identification of these risks can support more informed investment and acquisition decisions.
How are software lifecycle processes evaluated during due diligence?
Reviews typically assess software development procedures, change management activities, verification and validation records, traceability, maintenance processes, cybersecurity controls, and supporting documentation. The objective is to determine whether lifecycle activities support ongoing regulatory compliance and product maintenance obligations.
What happens after regulatory gaps are identified?
Following identification of gaps, organisations can prioritise remediation activities based on risk, business objectives, regulatory impact, and available resources. Remediation planning may include documentation updates, process improvements, additional testing, quality system enhancements, or regulatory strategy adjustments.
Can regulatory due diligence support licensing and partnership decisions?
Yes. Regulatory due diligence can provide independent insight into the compliance status, regulatory maturity, and potential liabilities associated with products or organisations involved in licensing agreements, strategic partnerships, distribution arrangements, or technology transfers.
How can MedQAIR support regulatory due diligence activities?
MedQAIR supports regulatory due diligence through compliance assessments, technical documentation reviews, quality management system evaluations, software and AI compliance assessments, cybersecurity reviews, regulatory gap analyses, and remediation planning. Our assessments help organisations understand regulatory readiness and potential compliance risks before critical business decisions are made.